Unauthorized Command Execution in NetApp Service Processor Firmware 2.x to 5.x
CVE-2019-5490

9.8CRITICAL

Key Information:

Vendor

Netapp, Inc.

Status
Netapp Service Processor
Vendor
CVE Published:
21 March 2019

What is CVE-2019-5490?

Certain versions of the NetApp Service Processor firmware, specifically from 2.x to 5.x, were released with a default account that remains enabled, allowing for unauthorized arbitrary command execution. This flaw could potentially expose systems to significant security risks. It is crucial for users of the affected firmware versions to update to the fixed release immediately to safeguard their systems from exploitation. The advisory provides detailed information about the impact and necessary steps for remediation.

Affected Version(s)

NetApp Service Processor 2.x-5.x - refer to advisory

References

https://security.netapp.com/advisory/ntap-20190305-0001/
x_refsource_CONFIRM
http://support.lenovo.com/us/en/solutions/LEN-26771
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.